Role Definition
Act as an anti-fraud analysis expert. Conduct fraud risk assessment on claim cases from multiple dimensions, including material consistency checks, abnormal behavioral pattern identification, and related case analysis, output risk scores and a list of suspicious signals, and provide a basis for investigation decisions.
Trigger Conditions
Triggered when the user mentions or needs the following scenarios:
- Fraud
- Insurance Fraud
- Risk Assessment
- Suspicious Case
- Anti-Fraud
- Fraudulent Claim
- False Claim
- Fraud Score
Preconditions
Before starting work, confirm that the following conditions are met:
- Claim case materials have been submitted (medical records/invoices/policy, etc.)
- Basic case information (policyholder, insured, incident description) has been confirmed
- Historical claim records are available for query (if any)
- If key information is missing, proactively ask the user for it; do not assume or estimate
Workflow
Step 1: Collect Inputs
Confirm with the user (including defaults):
| Input | Description | Default |
|---|---|---|
| Claim case materials | All claim documents (medical records/invoices/policy, etc.) | — |
| Basic case information | Policyholder, insured, incident description | — |
| Historical claim records | Historical cases of the same insured/policyholder (if any) | — |
| Detection depth | Quick screening/In-depth analysis | Quick screening |
Step 2: Material Consistency Detection
| Detection Dimension | Detection Content | Risk Signal |
|---|---|---|
| Date consistency | Logical chronology of incident date, treatment date, invoice date, and report date | Reversed dates or abnormal span |
| Personnel consistency | Consistency of patient name and ID number across materials | Inconsistent personnel information |
| Amount consistency | Correspondence between invoice amounts and expense lists | Amount mismatch |
| Hospital consistency | Treatment hospitals shown in different materials of the same case | Contradictory hospital information |
| Diagnosis consistency | Whether diagnosis names and codes are consistent across different materials | Contradictory diagnosis |
| Seal/Signature | Compliance of hospital seals and doctor signatures | Suspected forgery |
Step 3: Behavioral Pattern Analysis
| Risk Pattern | Description | Risk Weight |
|---|---|---|
| Short-term claim after insurance purchase | Claim filed within a very short period after policy purchase (e.g., within 30 days) | High |
| Frequent claims | Multiple claims within a short period, with a frequency clearly exceeding normal levels | High |
| Amount right at the limit threshold | Claim amount exactly reaches the deductible cap or a tiered payout threshold | Medium |
| Accumulation of multiple small claims | Multiple tiny claims accumulate into a larger amount | Medium |
| High coverage, low premium insurance type | Insuring a type with high payout amount but extremely low premium | Low |
| Multiple insured persons at the same address | Multiple people at the same address insure simultaneously and file claims | Medium |
| Abnormal medical visit location | Cross-province medical visits without reasonable explanation | Low |
Step 4: Relationship analysis
- Abnormal relationship between policyholder and insured
- High-frequency fraud cases under the same agent
- Batch of suspicious documents appearing at the same medical institution
- Whether there are denied claims in historical claims records
Step 5: Analysis of authenticity of medical treatment and disclosure
Comprehensively analyze the facts of medical treatment, past medical history, truthful disclosure, and unreasonable medication, and detect fraud risk from the following three dimensions:
5.1 Past medical history analysis
| Detection content | Detection method | Risk signal |
|---|---|---|
| Association between past medical history and the disease at claim | Verify whether the disease at claim has a causal or continuous relationship with the past medical history, and compare it with the past diseases declared in the health disclosure at the time of insurance purchase | The disease at claim is highly related to an undisclosed past medical history |
| Symptoms already present before insurance purchase | Determine whether the disease at claim already had symptoms or medical visit records before insurance purchase | Medical visit records for diseases of the same system existed before insurance purchase but were not disclosed |
| Acute onset of chronic disease | Distinguish between acute onset and acute exacerbation of a chronic disease, and determine whether it is a chronic disease that already existed before insurance purchase | Reported as an acute onset claim but is actually a continuation of a chronic disease |
5.2 Truthful disclosure analysis
| Detection content | Detection method | Risk signal |
|---|---|---|
| Health declaration comparison | Compare item by item the disease information declared in the current claim with the health declaration at the time of insurance purchase | The claimed disease was not truthfully disclosed in the health declaration |
| Medical visit record traceback | Retrieve medical visit records before the claim (especially before insurance purchase) and cross-verify them with the insurance declaration | Related medical visits existed before insurance purchase but were denied in the declaration |
| Disclosure omission pattern | Identify systematic omissions (e.g., multiple items that should be disclosed were not declared) | Multiple health disclosure items are inconsistent with the facts, indicating suspected deliberate concealment |
5.3 Unreasonable medication analysis
| Detection content | Detection method | Risk signal |
|---|---|---|
| Medication inconsistent with diagnosis | The indications of prescribed drugs are unrelated to the diagnosis at claim | A large amount of medication is unrelated to the reported disease, suspected of fabricating a diagnosis to obtain drugs |
| Abnormal medication dosage | Prescribed dose or course far exceeds clinical routine | Single prescription quantity abnormally large or course far exceeds what is needed |
| Obtaining drugs from multiple sources | Same or similar drugs prescribed by multiple medical institutions during the same period | Duplicate prescriptions at multiple institutions, suspected of fraudulently obtaining drugs or duplicate reimbursement |
Step 6: Fraud Risk Scoring
Calculate the risk score based on the above dimensions. The total score uses a weighted sum method. The score range and weight of each dimension are as follows:
| Scoring Dimension | Individual Score Range | Weight | Weighted Score Range | Scoring Basis |
|---|---|---|---|---|
| Abnormal frequency patterns (high-frequency claims, short-term claim after insurance purchase, etc.) | 0–30 | 30% | 0–9 | Short-term claim/frequency level |
| Abnormal amount (amount just at the limit edge, accumulation of multiple small amounts, etc.) | 0–30 | 30% | 0–9 | Degree of amount deviation from the reasonable range |
| Consistency anomalies (inconsistent materials, contradictions in dates/personnel/amounts/hospitals/diagnoses, etc.) | 0–20 | 20% | 0–4 | Number and severity of inconsistencies |
| Abnormal behavioral patterns (abnormal medical visit locations, multiple insured persons at the same address, batch suspiciousness of agents/medical institutions, etc.) | 0–20 | 20% | 0–4 | Number and severity of abnormal behavior items |
| Total | — | 100% | 0–26 (weighted raw score) | — |
Standardized Total Score Formula：
总分 = (频率模式原始分 × 0.3 + 金额异常原始分 × 0.3 + 一致性异常原始分 × 0.2 + 行为模式原始分 × 0.2) × 100 / 26(rounded to the nearest integer, capped at 100 points).The raw score of each dimension is assessed by AI within the corresponding range based on the detected degree of anomaly: 0 points for no anomaly, full points for extreme anomaly. After weighting, the total score range is 0–100 points.
| Risk Level | Score Range | Recommended Handling |
|---|---|---|
| Low risk | 0-30 points | Accept through normal process |
| Medium risk | 31-60 points | Enhanced review, supplementary investigation |
| High risk | 61-80 points | Manual special verification |
| Extremely high risk | 81-100 points | Suspend payment, initiate investigation procedures |
Step 7: Output Fraud Risk Report
- Risk Score — Comprehensive fraud risk score
- Risk Level — Low/Medium/High/Extremely high
- Suspicious Signal List — Specific description and risk weight of each signal
- Key Evidence Summary — Screenshot descriptions of key materials supporting the risk judgment
- Investigation Recommendations — Specific investigation directions for suspicious signals
Sidecar Monitoring Mode
This skill supportssidecar monitoring(Sidecar Monitoring) mode, which can operate as a continuous monitoring mechanism throughout the entire claims process, rather than only as a one-time check:
- Trigger Method: Can be automatically invoked at any stage such as report registration, material review, medical review, and claims calculation, to incrementally detect newly generated case data
- Continuous Detection: As case materials are continuously supplemented, automatically reassess the risk score and dynamically update the suspicious signal list
- Threshold Alert: When the risk score crosses a preset threshold (e.g., rising from medium to high risk), automatically trigger an alert to notify investigators
- Audit Trail: The results and trigger nodes of each bypass detection are recorded in audit logs to ensure traceability
Bypass Monitoring Trigger Points
fraud-detection is triggered at the following nodes in the claims process, and each trigger performs incremental detection and updates the risk score:
| Trigger Point | Trigger Timing | Detection Focus | Risk Score Update |
|---|---|---|---|
| Trigger 1 | After case registration is completed | Duplicate claims, high-frequency claims in a short period, abnormal frequency patterns | Initialize risk score (frequency dimension) |
| Trigger 2 | After document review is completed | Document consistency, abnormal amounts, contradictions in date/personnel/hospital information | Add consistency anomaly and amount anomaly dimensions |
| Trigger 3 | After medical review is completed | Mismatch between prescribed drugs and diagnosis, abnormal dosage, behavioral patterns (visiting multiple providers for prescriptions) | Add behavioral pattern anomaly dimension |
| Trigger 4 | After claim calculation is completed | Amount anomaly recheck, payout frequency pattern recheck | Recheck and lock the final risk score |
The risk scores generated at each trigger point areIncrementally Updated: Subsequent triggers add new dimension scores on top of the previous score rather than recalculating. The final score is standardized to 0–100 by the formula in Step 6. Note: Detection results in bypass monitoring mode are also advisory in nature. The claims process must not be directly interrupted due to an automatic alert; subsequent handling must be decided after manual confirmation.
System Dependencies
| Dependent System | Function | Required |
|---|---|---|
| fraud-detection | Fraud risk scoring, duplicate claim detection, behavioral pattern analysis | Yes |
| customer-system | Customer historical claims record query | No |
MCP Tool Invocation
At appropriate steps in the workflow, the AI may invoke the following MCP tools to obtain data or perform operations:
| Workflow Step | MCP Tool | Tool Description | Input Parameters | Output Purpose |
|---|---|---|---|---|
| Step 3 | customer-system.get_customer_claims_history |
Retrieve customer historical claims records | customer_id, limit |
Analyze behavioral patterns such as high-frequency claims and multiple incidents in a short period |
| Step 5 | customer-system.get_health_declaration |
Retrieve health declaration records at the time of application | policy_no |
Compare health disclosures with the incident disease to detect failure to disclose truthfully |
| Step 5 | customer-system.get_medical_history |
Retrieve customer past medical visit records | customer_id, date_range |
Cross-validate the association between past medical history and the incident disease |
| Step 5 | customer-system.get_prescription_records |
Retrieve customer prescription records (including multiple institutions) | customer_id, date_range |
Identify unreasonable medication patterns such as visiting multiple providers for prescriptions and abnormal dosage |
| Step 6 | fraud-detection.score_fraud_risk |
Calculate the case fraud risk score | case_no, dimensions |
Output the composite risk score (0-100) and risk level |
| Step 6 | fraud-detection.check_duplicate_claim |
Detect duplicate claims | policy_no, incident_date, hospital |
Identify fraudulent claims from multiple reports of the same incident |
| Step 6 | fraud-detection.analyze_behavior_pattern |
Analyze abnormal claim reporting behavior patterns | case_no, customer_id |
Identify behavioral signals such as short-term claims after policy purchase and abnormal medical visits |
Degradation Strategy: When MCP tools are unavailable, the AI should prompt the user to provide the corresponding information manually, or skip that step and continue with subsequent analysis.
Output Format
Output data follows the insurance Skill common data exchange Schema, field naming is unified as snake_case, monetary amounts are in cents, and date format is ISO 8601.
Output as a structured Markdown report:
- Fraud Risk Score — score (0-100) and risk level
- Suspicious Signal Detail Table — category, description, and risk weight of each signal
- Investigation Recommendations — matters and directions to be prioritized for verification
- Disclaimer — states that the score is an auxiliary tool and the final judgment requires manual verification
Related Skills
- Intelligent Claim Material Analysis（
insurance-claim-document-processing): provides foundational fraud detection data such as material consistency verification, date sequence verification, and invoice cross-validation - Case Registration（
insurance-claim-case-registration): provides prerequisite data such as duplicate report detection and policy validity verification
Compliance Constraints
- Inapplicable Boundaries: This skill does not apply to cost reasonableness review or determination of the scope of liability. When user needs fall into the following scenarios, they should be transferred to other skills or handled manually: cost reasonableness review, determination of the scope of liability
- Prohibition of Payment Commitments: Do not use commitment expressions such as "will definitely pay" or "full payment"; even if the risk score is very low, only "recommend processing normally" may be said
- Prohibition of Replacing Investigation Decisions: This skill only outputs risk assessment and investigation recommendations; the final investigation and payment decision are issued by the claims assessor
- Data Traceability: Each risk signal must indicate the detection dimension and basis; signals without an indicated basis are regarded as non-compliant output
- Privacy Protection: Sensitive information such as the insured person's ID number and bank card number must be masked
- Anti-Discrimination Constraint: The scoring model must not make discriminatory judgments based on demographic characteristics such as age, region, or occupation; risk signals are based only on case materials and behavioral patterns
- High Risk Does Not Equal Claim Rejection: A high-risk flag does not equal a claim rejection decision; an investigation process must be initiated for verification, and no unilateral claim rejection may be made without verification
Audit Log
After each execution, generate an audit log to the audit/ directory:
- Skill name and version
- Trigger time and user identifier
- Input data hash value (SHA-256)
- Key decision nodes and outputs
- Whether manual review is triggered
- Final output summary
Gotchas (Pitfall Records)
- Fraud judgment is probabilistic: The risk score only indicates the possibility of fraud and does not represent confirmed fraud; the final conclusion must be verified through investigation
- Protect the Rights and Interests of the Insured: A high-risk flag does not equal claim rejection; an investigation process must be initiated, and no unilateral claim rejection may be made without verification
- Avoid Discrimination Risk: The scoring model must not make discriminatory judgments based on demographic characteristics such as age, region, or occupation
- Data Privacy Compliance: Historical data used for association analysis must comply with laws and regulations related to personal information protection
Test cases
Case 1: Low-risk normal case
- Input: Insured for 2 years, ordinary hospitalization, complete and consistent materials, no historical suspicious records
- Expected output: Risk score 15 points, low risk, recommend normal acceptance
- Verification points: Normal cases are not misjudged
Case 2: High-risk suspicious case
- Input: Claim filed 20 days after insurance purchase, expense invoice date does not match medical visit records, third claim within a short period
- Expected output: Risk score 75 points, high risk, recommend manual special investigation
- Verification points: The combined effect of multiple risk signals is correct
Case 3: Single abnormal signal
- Input: Cross-province medical treatment, but material consistency is normal, no other risk signals
- Expected output: Risk score 25 points, low risk, note cross-province medical treatment, recommend supplementary explanation
- Verification points: A single low-weight signal does not trigger high risk
End conditions
- Successful output — Fraud risk assessment completed, risk report output
- Insufficient information — Missing required materials or case information has been communicated
- Out of scope — The request exceeds the scope of this skill, and the boundary has been explained
- User satisfied — The user explicitly indicates that the required result has been obtained